12:12 p.m.
I'm trying to be able to create different virtual LANs, where, for example, I have 2
groups of pcs
A and B belongs to network N1
C and D belongs to network N2
N1 and N2 with his own public IP. For example
A: Local ip: 192.168.122.100
B: Local ip: 192.168.122.101
C: Local ip: 192.168.122.102
D: Local ip: 192.168.122.103
Where A and B has the same public ip, and C and D has the same public ip.
Now, I want that A can ssh on B, but not on C or D. The same goes for C, where C can
access to D via ssh but not to A or B
I'm not sure if OVS solve this problem or not, or if this is not possible.
Is this possible? How?
8:37 a.m.
Hi,
andres.b.dev(a)gmail.com writes:
I'm trying to be able to create different virtual LANs, where,
for
example, I have 2 groups of pcs
A and B belongs to network N1
C and D belongs to network N2
N1 and N2 with his own public IP. For example
A: Local ip: 192.168.122.100
B: Local ip: 192.168.122.101
C: Local ip: 192.168.122.102
D: Local ip: 192.168.122.103
You've got a few problems here.
First, if you have two networks, N1, and N2, you probably DO NOT want
the same IP Network (192.168.122) on both N1 and N2. So for your
sanity, if A and B are on N1 and C and D are on N2, you might want to
use:
A: 192.168.10.100
B: 192.168.10.101
C: 192.168.20.100
D: 192.168.20.101
Where A and B has the same public ip, and C and D has the same public
ip.
I'm confused by this. What do you mean "has the same public ip"? None
of the IPs here are public, they are all RFC1918 (private network) IPs.
Do you mean that you've got a router, somewhere, that have a reverse NAT
that will translate externally from some public addresses to these
private addresses?
Also, you will need that reverse NAT to be smart about how it routes.
Specifically, once you have an active connection to A or B, it will need
to ensure that the connection continues to the same (A or B) target.
Now, I want that A can ssh on B, but not on C or D. The same goes
for
C, where C can access to D via ssh but not to A or B
I'm not sure I understand what this means. What do you mean by "A can
ssh on B"? This is probably a language issue. I think you mean that A
and B can ssh to each other but can't reach C or D, and C and D can ssh
to each other but can't reach A or B.
If you renumber as above then you can do that by not routing between
192.168.10.0/24 and 192.168.20.0/24. However in your original
configuration where all four hosts are on the same 192.168.122.0/24
network, there is no way (at the network level) to prevent A and B from
talking with C and D.
I'm not sure if OVS solve this problem or not, or if this is not
possible.
Is this possible? How?
You can do this with OVS, or even with basic networking, but you will
need to create actual separate networks.
Good Luck,
-derek
--
Derek Atkins 617-623-3745
derek(a)ihtfp.com www.ihtfp.com
Computer and Internet Security Consultant
6:41 p.m.
Hi Derek, thanks for the answer.
First, if you have two networks, N1, and N2, you probably DO NOT want
the same IP Network (192.168.122) on both N1 and N2. So for your sanity, if A and B are on
N1 and C and D are on N2, you might want to use
Sorry, my bad. Yup, masking...
I'm confused by this. What do you mean "has the same public
ip"? None of the IPs here are public, they are all RFC1918 (private network) IPs. Do
you mean that you've got a router, somewhere, that have a reverse NAT that will
translate externally from some public addresses to these private addresses?
Sorry about that. Answering your question, I think yes. I know that 192.X.Y.Z is not
public. I mean, I want that as local ip and, for example, 172.X.Y.Z as public ip for the
network. Basically, I want to simulate an office, where the owner of the company pays 1
ISP. That isp gives you a router with 1 public ip, and all connected PC (VMs here) has his
own local ip. It could be 192.X.Y.Z or 10.X.Y.Z (right? not a network expert as you may
notice :P).
I'm not sure I understand what this means. What do you mean by
"A can ssh on B"? This is probably a language issue. I think you mean that A and
B can ssh to each other but can't reach C or D, and C and D can ssh to each other but
can't reach A or B.
Yes, I want that. A <-> B, C <-> D
If you renumber as above then you can do that by not routing between
192.168.10.0/24 and 192.168.20.0/24. However in your original configuration where all four
hosts are on the same 192.168.122.0/24 network, there is no way (at the network level) to
prevent A and B from talking with C and D.
Yes, I forgot about the network mask.
You can do this with OVS, or even with basic networking, but you will
need to create actual separate networks.
What do you mean with creating actual separate networks? Having 1 NIC per public IP?
Because I have only 4 NICs and I want to have as many public IPs as possible because I
want to have as many virtual offices as possible.
Regards.
2145
days inactive
2146
days old
2 comments
2 participants
participants (2)
-
andres.b.dev＠gmail.com -
Derek Atkins